LoginSign Up
← Back to all sparks
N

ntopng

ANALYTICS
Velocity0.0

Network traffic monitoring and analysis tool

www.ntop.org ↗

ntopng 7.0 adds an AI traffic analyst, Wazuh integration and BGP in one release.

network-monitoringai-analystmcpwazuhclickhousebgp
◆Current state
ntopng 7.0 arrived in September, ten months after 6.6. nAnalyst brings AI chat, policies, dashboards and an agentic loop across multiple LLM providers, with an MCP server included. The release also adds Wazuh XDR/SIEM integration, a Sites hierarchy, BGP/BMP with RPKI validation, a ClickHouse timeseries engine, OpenID Connect SSO, MFA and passkeys, and a new Vue.js frontend replacing legacy pages.
◆Where it's heading
Each major has annexed an adjacent category, and 7.0 reaches for three at once: AI-assisted analysis, SIEM-adjacent security and routing visibility. ClickHouse is now the assumed foundation, and nAnalyst requires it. The licensing line is also explicit, with nAnalyst limited to enterprise M and above and the MCP functions split between community and pro.
◆Prediction
Point releases should focus on nAnalyst and the new frontend, the two largest and least mature surfaces. The next major, on past spacing, is about a year off and likely extends the same analysis and security surfaces.

◆Recent moves

  1. 1mo ago

    ntopng 7.0: nAnalyst AI, Wazuh integration, BGP and Sites

    7.0 adds nAnalyst, Wazuh integration, Sites, BGP/BMP, a ClickHouse timeseries engine and modern sign-in, on a rebuilt Vue.js frontend. It continues the pattern of each major absorbing a neighboring category, this time with AI analysis gated to enterprise tiers.

    View source ↗
  2. 11mo ago

    ntopng 6.6: AS dashboards and real-time ClickHouse export

    Adds autonomous-system dashboards, Sankeys and AS statistics, reworks flow collection, and introduces a direct dump mode for real-time ClickHouse export with native ClickHouse Cloud SSL support. The real-time export path is the structural change here.

    View source ↗
  3. 1y ago

    ntopng 6.4 adds Asset Inventory and Digital Twin

    ⚡ SPARK

    6.4 introduced an Asset Inventory and Digital Twin with a dedicated dashboard, an Infrastructure Dashboard spanning multiple regions, and Quality of Experience indicators — moving ntopng from observing traffic to maintaining a model of the network itself.

    View source ↗
  4. 2y ago

    ntopng 6.2: memory halved, MITRE alert classification

    A performance-focused major that halved memory footprint and reduced lock contention, while adding MITRE alert classification and a new security report. The optimisation work is what made the later feature expansion affordable.

    View source ↗
  5. 3y ago

    ntopng 6.0 adds vulnerability scanning and CVE support

    ⚡ SPARK

    6.0 added vulnerability scanning and CVE support to a traffic monitor, along with configurable dashboards, traffic reports, Modbus alerts and PagerDuty and TheHive integrations. It is where the security direction starts.

    View source ↗
  6. 3y ago

    ntopng 5.6: Kafka, ClickHouse clusters, Vue.js rework

    Adds Kafka support, ClickHouse cluster support and an XL license tier, and begins reworking pages onto Vue.js toward a responsive client. Infrastructure groundwork for the larger deployments the later releases target.

    View source ↗